[uml-devel] reading uninit memory in do_io (ubd_kern.c)

[John Reiser <jreiser@BitWagon.com>]

[-- Attachment #1: Type: text/plain, Size: 831 bytes --]

Function do_io() in arch/um/drivers/ubd_kern.c can read uninitialized memory
when scanning the .sector_mask.  During startup the maximum .length
is 64K (and has been observed), so 128 bits are needed [512-byte sectors.]
Initialized .sector_mask has 32 bits, and initialized .cow_offset has 64,
so 32 bits must come from .bitmap_words[0]; but .bitmap_words is not
initialized by prepare_request().

If .fds[0]==.fds[1], as it is in early startup, then the net effect
of scanning the uninit .bitmap_words[0] is "merely" a randomness and
possible slowdown in I/O operations, which is better to avoid anyway.

Either call blk_queue_max_sectors() much earlier (and always) in order
to restrict all transfers to at most 32 [or 96] sectors, else apply
the attached patch to clear .bitmap_words[0].

-- 
John Reiser, jreiser@BitWagon.com


[-- Attachment #2: ubd_kern.c.patch --]
[-- Type: text/x-patch, Size: 634 bytes --]

--- linux-2.6.23/arch/um/drivers/ubd_kern.c	2007-12-04 14:49:28.000000000 -0800
+++ new/arch/um/drivers/ubd_kern.c	2007-12-04 14:55:32.000000000 -0800
@@ -1069,6 +1069,12 @@
 	io_req->length = len;
 	io_req->error = 0;
 	io_req->sector_mask = 0;
+/* At startup, the maximum .length is 64K, and blk_queue_max_sectors()
+ * has not been called yet.  So do_io() could require 64K/(1<<9) = 128 bits:
+ * 32 in sector_mask, 64 in cow_offset, 32 in bitmap_words[0].
+ * 2007-12-04 jreiser (valgrind/memcheck)
+ */
+	io_req->bitmap_words[0] = 0;
 
 	io_req->op = (rq_data_dir(req) == READ) ? UBD_READ : UBD_WRITE;
 	io_req->offsets[0] = 0;


[-- Attachment #3: Type: text/plain, Size: 309 bytes --]

-------------------------------------------------------------------------
SF.Net email is sponsored by: The Future of Linux Business White Paper
from Novell.  From the desktop to the data center, Linux is going
mainstream.  Let it simplify your IT future.
http://altfarm.mediaplex.com/ad/ck/8857-50307-18918-4

[-- Attachment #4: Type: text/plain, Size: 194 bytes --]

_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel